Authorization

To use the API, you need to authenticate your requests using an API token.

Getting Your API Token

1. Go to https://cart.easy.tools/creator/store-settings/developer
2. Generate a new API token
3. Copy and securely store your token

An API token belongs to your user account, not to a single store. It works with your own store and with any store whose team granted you the Use the Easycart API permission — see Store selection below.

Using the API

Base URL

All API requests should be made to:

https://cart.easy.tools/api/v1

Authentication

Include your API token in the Authorization header using Bearer authentication:

Authorization: Bearer YOUR_API_TOKEN

JSON request bodies use Content-Type: application/json. The byte PUT in Upload Media sends the raw file with the headers from upload_request, and does not send Authorization. Prepare and complete on that upload stay JSON, with the Bearer token. Upload Product Media and Upload Storefront Media are multipart/form-data instead — curl -F sets that for you.

Content-Type: application/json
Accept: application/json

Example Request

curl -H "Authorization: Bearer YOUR_API_TOKEN" \
     -H "Content-Type: application/json" \
     -H "Accept: application/json" \
     https://cart.easy.tools/api/v1/endpoint

Store Selection

Every request operates on exactly one store. Without any extra headers, requests target your default store — for most users, the store they own.

If your token has access to more than one store, pass the store's ID in the X-Easycart-Store header to direct the request at that store:

X-Easycart-Store: 22b65ad7-ef20-4d46-9f04-110eba99cc77

Store IDs come from List stores, which returns every store your token can reach and marks the default one. A store grants or revokes API access through its team role permissions; revoking takes effect immediately on the next request.

Example Request

curl -H "Authorization: Bearer YOUR_API_TOKEN" \
     -H "X-Easycart-Store: 22b65ad7-ef20-4d46-9f04-110eba99cc77" \
     -H "Content-Type: application/json" \
     -H "Accept: application/json" \
     https://cart.easy.tools/api/v1/orders

Access Errors (403 Forbidden)

Selecting a store that has not granted you API access — or that does not exist — returns 403 on any endpoint:

{
  "message": "You do not have API access to the requested store."
}

When the header is omitted and your default store has not granted you API access, the 403 asks for an explicit selection instead:

{
  "message": "You do not have API access to this store. Pass the X-Easycart-Store header to select a store you have API access to."
}

Rate Limiting

The API enforces rate limiting per store:

• 100 requests per 60 seconds
• Completing an upload, Upload Product Media, and Upload Storefront Media also allow 60 uploads per 60 seconds per store, in addition to the limit above. The three share this budget.

Either limit returns 429. A key that can reach several stores gets a separate upload budget on each store. Uploads made in the dashboard do not share this 60-upload budget. The byte PUT of an upload has its own limit of 20 requests per minute per client IP address.

Rate Limit Headers

All responses include rate limit information:

Header	Description
X-RateLimit-Limit	Maximum requests allowed in the window

When rate limited, additional headers are included:

Header	Description
X-RateLimit-Remaining	Requests remaining (always 0 when limited)
Retry-After	Seconds until the rate limit resets

Rate Limit Error (429 Too Many Requests)

{
  "message": "Too many requests. Please retry after 60 seconds."
}